René's URL Explorer Experiment

Title: CHORE: add mock TDS FedAuth regression test + CI install for deferred access-token UAF (#594/#596) by saurabh500 · Pull Request #652 · microsoft/mssql-python · GitHub

Open Graph Title: CHORE: add mock TDS FedAuth regression test + CI install for deferred access-token UAF (#594/#596) by saurabh500 · Pull Request #652 · microsoft/mssql-python

X Title: CHORE: add mock TDS FedAuth regression test + CI install for deferred access-token UAF (#594/#596) by saurabh500 · Pull Request #652 · microsoft/mssql-python

Description: Work Item / Issue Reference GitHub Issue: #594 (fixed by #596) Summary Adds tests/test_024_mock_tds_fedauth.py, an integration test that uses the mssql-mock-tds in-process TDS server to guard the deferred connect-attribute use-after-free fixed in #596 (issue #594), and wires the mock server install into the PR-validation pipeline so the test actually runs (instead of skipping) on every test leg. Why SQL_COPT_SS_ACCESS_TOKEN (1256) is a deferred ODBC connect attribute: the MS ODBC driver stashes the caller's pointer at SQLSetConnectAttr time and only dereferences it later, during SQLDriverConnect, to build the FedAuth Login7 packet. PR #568 briefly copied the value into a stack-local buffer that was freed before that deferred read — a use-after-free that variously produced SIGBUS, a server reset, or "Authentication token is missing in the federated authentication message." PR #596 fixed it by storing the value in Connection-owned member buffers. This regression is invisible to ordinary unit tests because it only manifests once a real driver actually transmits the token to a server. The mock TDS server gives us exactly that: it records the access token it received in the Login7 FedAuth feature. What the test does For each case it sets attrs_before={SQL_COPT_SS_ACCESS_TOKEN: token_struct}, lets the real ODBC driver transmit the token to the mock server, and asserts the server captured the exact token. If the deferred buffer is ever corrupted again, the captured token won't match (or won't arrive) and the test fails. test_access_token_round_trips_to_server — direct guard: exact byte-for-byte round-trip. test_unique_access_token_transmitted_exactly — random unguessable token rules out any cached/constant fallback. test_distinct_tokens_on_sequential_connects — two sequential connects with different tokens, exercising the per-attribute owned buffers from #596. CI integration Adds a reusable install step (eng/pipelines/steps/install-mock-tds.yml, backed by install-mock-tds.{sh,ps1} and pinned via eng/versions/mssql-mock-tds.version), mirroring the existing install-mssql-py-core pattern. It installs mssql-mock-tds + cryptography from the public mssql-rs_Public feed and is referenced from every test leg (Windows, macOS, and all Linux containers incl. Alpine/musl and ARM64). The scripts are best-effort: if a compatible wheel is ever missing or the sandbox feed is unavailable, they emit a pipeline warning and exit 0, so the leg stays green and the test simply skips there. Notes Opt-in / skips cleanly when mssql-mock-tds or cryptography aren't installed, so it won't break CI legs that don't install the mock. The mock package currently lives on the mssql-rs_Public sandbox feed (from draft microsoft/mssql-rs#80): pip install --index-url https://pkgs.dev.azure.com/sqlclientdrivers/public/_packaging/mssql-rs_Public/pypi/simple/ mssql-mock-tds Generates a throwaway TLS identity in a temp dir (the mock requires TLS for FedAuth) — no certs/artifacts land in the repo. The driver's connect still times out (the mock doesn't complete the full handshake); that is expected and intentionally not asserted on — only the captured token matters, and it has already been transmitted by then. A short login timeout keeps the tests fast (~13s total). Validation Built the ddbc_bindings extension locally from this branch's source and ran the suite: 3 passed. NoteDraft pending the mssql-mock-tds package being published to a stable feed (currently sandbox-only via microsoft/mssql-rs#80). Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

Open Graph Description: Work Item / Issue Reference GitHub Issue: #594 (fixed by #596) Summary Adds tests/test_024_mock_tds_fedauth.py, an integration test that uses the mssql-mock-tds in-process TDS server to guard th...

X Description: Work Item / Issue Reference GitHub Issue: #594 (fixed by #596) Summary Adds tests/test_024_mock_tds_fedauth.py, an integration test that uses the mssql-mock-tds in-process TDS server to guard th...

Opengraph URL: https://github.com/microsoft/mssql-python/pull/652

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width